AI Watermark Evidence Fails Forensic Readiness: An Empirical Evaluation

Current watermarking methods fail basic forensic standards: When evaluated against legal admissibility criteria (Daubert standards) and digital forensic best practices (NIST SP 800-86), three representative LLM watermarking methods—KGW, Unigram, and SynthID-Text—all failed to meet the reliability threshold needed for courtroom evidence, despite government mandates requiring "sufficiently reliable and robust" watermarks.

Watermarks are easily removed through simple paraphrasing: In testing 846 paraphrase attempts across three watermarking methods, KGW and Unigram watermarks were removed 100% of the time after meaning-preserving paraphrasing, while SynthID lost its watermark 98.3% of the time—a legally realistic attack that cannot be dismissed as evidence tampering since paraphrasing is a normal form of communication.

High false-negative rates mean watermarks miss AI content: Before any attack, the watermarking methods already failed to detect AI-generated text at alarming rates (70% for KGW, 83% for Unigram, 80% for SynthID), meaning they would miss the majority of AI-generated content in real-world scenarios where detection is needed.

False positives create additional legal problems: SynthID incorrectly flagged 5.4% of human-written paraphrased text as AI-generated, creating a risk of wrongly accusing humans of using AI tools and undermining the credibility of watermark evidence in legal proceedings.

Regulatory mandates rest on untested assumptions: Both the EU AI Act and California's SB 942 require watermarks without empirical evidence that watermark detection can actually produce reliable evidence suitable for courts, potentially creating compliance burdens that don't deliver